Cybersecurity SOC Analyst Lab - Brute Force (SSH)

Рет қаралды 8,416

Күн бұрын

Пікірлер: 32

@Philbon 8 ай бұрын

Knowing which lab to do is one thing but your detailed explanations of the topics are so helpful. Working through your project videos and adding them to my github portfolio. Keep it up!

@MyDFIR 8 ай бұрын

You're very welcome! More labs to come :)

@Just_A_Tech.._ 8 ай бұрын

Awesome👌💓💯 Looking forward to your SOC course.

@MyDFIR 8 ай бұрын

Thank you❤️

@x0rZ15t 8 ай бұрын

@12:33 One of those days I'll make a t-shirt saying "sort | uniq -c | sort -nr" since this is also my most used bash command sequence. Great content as always!

@MyDFIR 8 ай бұрын

😂😂that is a good idea

@shadrachwilson1211 8 ай бұрын

Good content. I’m patiently waiting for the full SOC Analyst course😊

@MyDFIR 8 ай бұрын

Thanks ❤️❤️

@BamgboyeAlex 6 ай бұрын

Well-explained

@MyDFIR 6 ай бұрын

Thank you ❤️

@nicolasgregori577 8 ай бұрын

excellent content bro

@MyDFIR 8 ай бұрын

Appreciate it!

@joshgo2888 8 ай бұрын

Thank you for the wonderful content, Whenever I encounter these type of challenges specially in THM, I test a python script to parse data. I practice that not to discourage the knowledge of log analysis but I found that method instead, just in case there are scenario's that are needed to be delivered in fast phased environment, implementations and analysis.

@MyDFIR 8 ай бұрын

A python script is a wonderful idea, in fact I would encourage it! Great job 🙌

@umarwahab3827 12 күн бұрын

Wsl is not working on my windows virtual box , so how to open the hackthebox file in linix

@MyDFIR 11 күн бұрын

You could download ubuntu desktop VM or transfer it over from your Windows host to Ubuntu VM

@aDenstech Ай бұрын

Hi, I have just started learning SOC and my question may be seems silly, but what happens if attacker deletes log files after gaining access as a sudo user.

@MyDFIR Ай бұрын

Not silly at all and a valid question! This is where we hope you are sending logs over to a SIEM :) if not, forensics could hopefully help by looking at other logs (if applicable) - there will always be traces left behind. Although we won’t get 100%, but if we can get enough evidence, we can be in a good spot.

@aDenstech Ай бұрын

@@MyDFIR Thanks for reply, much appreciated.

@sumeshkumar9940 8 ай бұрын

hi, can you tell me why we took 37 as task 4's answer

@sumeshkumar9940 8 ай бұрын

first session is 34 right i did not understand that part

@sumeshkumar9940 8 ай бұрын

is it because the session only lasted for a sec

@MyDFIR 8 ай бұрын

Great question, on paper the first session is indeed 34 BUT nothing was “done” within that session and lasted only a second thus, it was likely an automated scan of some sort. In session 37, the attacker actually did stuff making this the session of interest.